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The Information Commissioner is responsible for promoting and enforcing data 
protection law in the UK including the General Data Protection Regulation (GDPR) and 
the Data Protection Act 2018 (DPA). She is independent of government and upholds 
information rights in the publicinterest, promoting openness by public bodies and data 
privacy for individuals. She does this by providing guidance to individuals and 
organisations, solving problems where she can, and taking appropriate action where the 


law is broken. 


In June 2020, the Information Commissioner's Office (ICO) published a report! (“our 
report”) of its investigation into the practices used by police forces in England and Wales 
when extracting data from mobile phones in the context of criminal investigations. In 
addition, the ICO has a separate ongoing investigation looking more broadly into the 
path data relating to victims of rape and serious sexual offences takes through the 
criminal justice system from allegation, through disclosure, prosecution and 
compensation. The findings from both these investigations have implications that are 


directly applicable to this consultation. 


Much has been written recently about the diminishing confidence victims have in coming 
forward to report serious sexual crimes and being confident that they will be treated with 
dignity and without undue intrusion into the most intimate aspects of their lives. It is 
essential when they seek therapy, following an offence committed against them, that 
they are able to focus on obtaining the help that they require by speaking openly with 
their therapist in the knowledge that the notes of their sessions will be treated with the 


respect for privacy that they deserve. 


The draft guidance could do significantly more to address the privacy and data 
protection issues arising when undertaking pre-trial therapy, especially in circumstances 


where the police may seek access to records of therapy sessions. 


 https://ico.org.uk/media/about-the-ico/documents/2617838/ico-report-on-mpe-in-england- 
and-wales-v1_1.pdf 
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In the following sections, we set out general principles and points we feel should be 
taken into consideration in drafting the revised guidance, before responding to the 


specific questions posed in the consultation. 
The nature of pre-trial therapy notes 


The GDPR sets out key data protection principles, rights and obligations in relation to 
processing of personal data. The ICO has developed guidance? to assist in the 


understanding of this legislation. 


Article 5 GDPR sets out six principles that underpin lawful processing, and therapy 
providers, as controllers of data on their clients, should ensure they are familiar with 
these and pay particular attention to the Article 6 requirements to identify the lawful 


basis for their processing. 


In addition to the general requirements mentioned above, there are particular 
characteristics of pre-trial therapy notes that require special attention to be given to 


their processing. 


First, of significance to this consultation is the processing of ‘special category data’ 
and the particular conditions and safeguards required to be in place in order that such 
processing may be lawful. Included within the definition of special category data in 
Article 9 GDPR is “data concerning health or data concerning a natural person’s sex life 
or sexual orientation”. By the very nature of the engagement, pre-trial therapy notes 


relate to health, and it is quite conceivable that other relevant issues may be engaged. 


Therefore, in addition to the lawful basis requirement for general processing, this special 
category processing requires therapy providers to identify a basis in Article 9 and alsoa 


corresponding condition from Schedule 1 DPA. 


For example, Article 9(2)(h) GDPR permits the processing of special category data if the 
“processing is necessary for the purposes of preventive or occupational medicine, forthe 
assessment of the working capacity of the employee, medical diagnosis, the provision of 
health or social care or treatment or the management of health or social care systems 
and services on the basis of Union or Member State law or pursuant to contract with a 


health professional and subject to the conditions and safeguards referred to in 


* https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data- 
protection-regulation-gdpr/ 
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paragraph 3”. In this context, paragraph 3 refers to the duty of professional 


confidentiality. 


A possible relevant basis in UK law is set out in Schedule 1 condition 2 DPA, and states 
that the processing must be “necessary for health and social care purposes”, which 


includes the provision of health care or treatment, and the provision of social care. 


The other issue of particular relevance is the Article 10 GDPR requirement for special 
attention be given to data relating to criminal offences (including allegations, 
proceedings or convictions), and this includes data about the victims themselves. The 
draft guidance under consultation makes it clear that therapy providers may be 


processing information about such criminal matters whilst engaging with a victim. 


Article 10 states that processing of criminal offence data carried out ‘under the control of 
official authority’ does not require any further authorisation in UK law. However, in other 
settings, such as a therapy provider, a Schedule 1 DPA condition will need to be required 
for the processing to be lawful and, depending on the condition relied upon, an 


appropriate policy document may be required to be in place. 


The ICO has published guidance? that aims to assist health and social care providers in 


understanding their obligations when processing personal information. 
Transparency 


Article 13 GDPR sets out a range of information that must be provided to persons whose 
data is going to be processed. Therapy providers will need to consider the capacity of a 
victim who may still be undergoing trauma to fully understand the information that is 
being provided to them and ensure they present it in an accessible form. Victims need to 
be made fully aware of the details of how their data will be processed, including the fact 
that the information provided by them or recorded about them by the therapist could 
possibly be disclosed to police and used as evidence under specific circumstances. They 
should be fully informed and understand exactly what will happen with the information 


that they disclose. 


The victim’s information rights should be clearly explained to them from the outset. 


3 https://ico.org.uk/for-organisations/in-your-sector/health/ 
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Right to object to processing 


Of the range of informationrights available to all persons whose personal information is 
being processed, the Article 21 GDPR right “to object, on grounds relating to his or her 
particular situation, at any time to processing of personal data concerning him or her” is 
worthy of particular note. This applies when the processing is carried out under the 


lawful bases set out in Article 6 (e) or (f). 


Therefore, for example, if the processing is taking place under the Article 6 (f) 
‘legitimate interests’ condition, victims have the opportunity to request that their data is 
not processed (e.g. stored or shared). The therapy provider would be required to comply 
with this request unless it was able to demonstrate “compelling legitimate grounds for 


the processing which override the interests, rights and freedoms” of the victim. 
Police use of pre-trial therapy notes In criminal investigations 


Unlike therapists, who will be processing data under the GDPR, police will be undertaking 


processing for law enforcement purposes, which is governed by Part 3 of the DPA. 


The processing of data concerning health in such circumstances is classed as “sensitive 
processing” for law enforcement purposes and is therefore subject to stricter conditions 
than would otherwise be the case. Our report analysed in detail the conditions necessary 


for such processing to be lawful. 


The requirements underpinning this lawfulness include having an underlying basis in law, 
namely the obligations of investigators (under the Criminal Procedure and Investigations 
Act 1996 (CPIA)) to pursue all reasonable lines of enquiry whether they point towards or 
away from the suspect, and also satisfying a specific condition: either (i) the data 
subject gives their consent, or (ii) the processing is strictly necessary. In our report, 
we set out additional safeguards required under the DPA, including that one of the 


conditions set out in Schedule 8 DPA applies. 


Since the publication of our report, the Attorney General’s Guidelines on Disclosure have 
been revised and the draft due to come into force in 31 December 2020 reminds 
investigators (at paragraph 6) of the requirement for them to consider carefully the 


questions that arise when “both the right to a fair trial and the privacy of complainants 


* Section 35(8) DPA 2018 
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and witnesses are engaged”. Further guidance on this issue is provided by the Court of 
Appeal in Bater-James and Mohammed [2020] EWCA Crim 790. 


Reasonable lines of enquiry 


We do not underestimate the challenges for police, under the CPIA Code of Practice, to 
pursue all reasonable lines of enquiry whether they point towards or away from the 
suspect, in identifying proportionate enquiries — and we accept that these may change 


throughout the course of an investigation. 


However, The Attorney General has set out that such enquiries must never be 
speculative and must always be based on a belief that relevant material exists that will 


be revealed by the specific enquiry. 


There is an obligation to consider the extent to which intrusion into the private life of a 
person is justified or whether alternative means could be engaged to achieve the same 


objective of satisfying the line of enquiry. 


The ‘data minimisation’ principle sets out that “personal data being processed for law 
enforcement purposes must be adequate, relevant and not excessive”. This means that 
enquiries need to be sharply focused, aimed at areas where there is a belief that 
material relevant to a reasonable line of enquiry exists. This should never involve the 
collection of all available information inthe hopeit may reveal something that may 
possibly become relevant, nor should large volumes of data be collected in order to 


generate lines of enquiry. 
Sharing personal data with the police 


Whilst therapist providers process data under the GDPR and police under the DPA, there 
is a framework that allows the sharing of personal data where it is necessary and 
proportionate to do so for law enforcement purposes, such as the prevention, 


investigation and detection of crime. 


Where a request is received from the police, therapists must be satisfied that sharing 
personal data with a law enforcement authority is lawful. This means having an 
appropriate lawful basis under Article 6 GDPR (along with the Articles 9 and 10 


requirements, as applicable) before personal data is shared. 


> Section 37 DPA 
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We note the draft guidance suggests that sharing data with the policeis done with the 
consent of the victim. It is important at this point to draw the distinction between 
securing the agreement of a victim to allow some of their notes to be shared and the 


concept of ‘consent’ in data protection legislation. 


One possible lawful basis for sharing the data could be that set outin Article 6(1)(a) - 
namely that “the data subject has given consent to the processing of his or her 


personal data for one or more specific purposes”. However, this may not be practical. 


Consent, under GDPR, must be a “freely given, specific, informed and unambiguous 
indication of the data subject's wishes by which he or she, by a statement or by a clear 
affirmative action, signifies agreement to the processing of personal data relating to him 
or her”.© Recital 42 GDPR further specifies that “consent should not be regarded as freely 
given if the data subject has no genuine or free choice or is unable to refuse or withdraw 


consent without detriment”. 


As stated in our report, in the specific circumstances of pre-trial therapy notes being 
passed to police during a police investigation, the duty on police to retain material of 
relevance to an investigation makes it impractical for the withdrawal of consent to result 
in the cessation of processing. Also, in the context of a victim wishing their case to be 
progressed without detriment, itis difficult to envisage how consent would be truly freely 


given. 


A more appropriate lawful basis forthe sharing may be that set out in 

Article 6(1)(f) GDPR (“processing is necessary for the purposes of the legitimate 
interests pursued by the controller or by a third party, except where such interests are 
overridden by the interests or fundamental rights and freedoms of the data subject 
which require protection of personal data, in particular where the data subject is a 
child”). 


This requires an assessment as to whether the legitimate interests in relation to 
ensuring a law enforcement authority has all the necessary information fora proper and 


fair investigation outweighs the rights and freedoms of the victim. 


The “purpose limitation” principle in Article 5 GDPR states that “personal data shall be 


collected for specified, explicit and legitimate purposes and not further processed in a 


6 Article 4(11) GDPR 
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manner that is incompatible with those purposes”. This means consideration needs to be 
given to whether this new purpose is compatible with the original purpose. When sharing 
pre-trial therapy notes with the police, therapy providers need to be able to demonstrate 
that there is a clear legal provision requiring or allowing the new processing in the public 
interest. They should, therefore, be provided with sufficient information by the police in 


order for them to be able to make this assessment and potentially challenge the request. 
Disclosure of special category and criminal offence data to the police 


Whilst the above discussion has covered the considerations necessary for the lawful 
sharing of personal data with the police, there are further requirements if the personal 
data being shared consists of special category data (in this case information about the 
victim’s health, sexual orientation or sex life), or criminal offence data (in this case 


details of an alleged offence), or both. 


To share special category data with a law enforcement authority, in addition to having 
a lawful basis under Article 6, it is necessary to identify a specific condition for 
processing special category data under Article 9(2) GDPR and link this toa 


corresponding condition from Schedule 1 DPA. 


A possible condition that therapist providers could rely upon in these circumstances 
comes from Article 9(2)(g) GDPR (‘substantial public interest’), with the linked condition 
in paragraph 10 of Schedule 1 DPA (preventing or detecting unlawful acts’). 


This condition can be relied upon if the disclosure (i.e. sharing): 
e is necessary for the purposes of preventing or detecting an unlawful act; 


e must be carried out without the consent of the data subject so as not to prejudice 


those purposes; and 
e is necessary for reasons of substantial public interest. 


The difficulties of relying on consent have been discussed above. Because of the 
challenges associated with the CPIA, consent of the data subject cannot reasonably be 


achieved. 


The term “substantial public interest” is not defined in the GDPR or the DPA. However, 
the public interest can be taken to cover a wide range of values and principles relating to 


the public good, or what is in the best interests of society. Substantial public interest 
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means the publicinterest needs to be real and of substance, for example the protection 


of society from further risk of harm by an offender. 


As noted previously, criminal offence data includes personal data about criminal 
convictions and offences, or related security measures, and includes information about 


allegations of an offence and its victim. 


Criminal offence data can only be shared with law enforcement authorities if there is a 
lawful basis under Article 6 GDPR and either: 


e the processing is carried out under the control of official authority (for example, 
public authorities, such as the Driver and Vehicle Licensing Authority; the 
Disclosure and Barring Service; and the courts, have specific roles which may give 


them the official authority to process criminal offence data); or 


e you have lawful authority under Article 10. The DPA sets out specific conditions 


providing lawful authority in Schedule 1. 


As with special category data, paragraph 10 of Schedule 1 DPA is also likely to providea 
condition for sharing criminal offence data for preventing or detecting unlawful acts. You 


can rely on this condition if: 
This condition can be relied upon if the disclosure (i.e. sharing): 
e is necessary for the purposes of preventing or detecting an unlawful act; 


e must be carried out without the consent of the data subject so as not to prejudice 


those purposes; and 
e is necessary for reasons of substantial public interest. 


Unlike special category data, when processing criminal offence data for preventing or 
detecting unlawful acts, there is no requirement to explicitly demonstrate that the 
processing is necessary for reasons of substantial public interest, as paragraph 36 of 


Schedule 1 DPA removes this requirement for criminal offence data. 
Key points for therapy providers to consider 


1. Therapy notes are classed as special category data, and they may also contain 


criminal offence data if details of the incident or other criminal acts are recorded. 
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2. 


Providers need to be clear about the lawful basis (under Article 6 GDPR) under which 
they are processing their clients’ personal data. This could, for example, be the 


Article 6(1)(f) ‘legitimate interests’ condition. 


. They need to understand that they may process special category data on the basis of 


the Article 9(2)(h) GDPR ‘provision of health or social care or treatment’ condition 
linked to Schedule 1 condition 2 DPA that states it is ‘necessary for health and social 


care purposes’. 


. Any criminal offence data may be processed if it is compliant with Article 10 GDPR 


and a linked condition is identified in Schedule 1 DPA, such as the Schedule 1 


condition 2 ‘necessary for health and social care purposes’. 


. Information compliant with Article 13 GDPR must be provided to any victim or other 


person whose data is being processed. 


. Providers must understand their obligations under each of the principles set out in 


Article 5 GDPR. 


. Particular attention should be paid to the ‘data minimisation’ principle, especially in 


circumstances where requests are received to disclose data. This may mean 
restricting which records are shared or redacting information in individual records 


before they are shared. 


. When receiving a request from police for access to a victim’s data, therapists must 


consider carefully the detail of the request, and: 
a. be clear that the Article 6(1)(f) GDPR ‘legitimate interests’ condition applies; 


b. to comply with additional requirements around disclosure of special category or 
criminal offence data, ensure that the sharing is necessary for preventing or 
detecting unlawful acts and that (in the case of special category data) it is 


necessary for reasons of substantial public interest; 


c. consider any objection raised by the victim in relation to the sharing of their 
data; 


d. make an assessment as to whether the requirement for personal data to be 
disclosed to support the investigation outweighs the rights and freedoms of the 


victim; 
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e. engage with the victim to clearly explain the detail of any proposed disclosure, 


but do not rely solely on consent as a basis for sharing; and 
f. document their considerations and decisions. 


9. Therapy providers should consider whether, depending on which Schedule 1 condition 


they are relying upon, they require an appropriate policy document to be in place. 
Key points for police to consider 


1. The sensitivity and confidentiality of pre-trial therapy notes needs to be recognised, 
and police should only seek access to information contained in them in circumstances 


where: 


a. they have ascertained that it is strictly necessary in order to satisfy a 
reasonable line of enquiry, having considered other means and the privacy of 


the victim; 


b. they are able to explain to the therapy provider why the informationis 


required, and be specific about what is required; and 


c. the request is for the minimum amount of information that is sufficient to 


discharge the particular line of enquiry. 


2. It must be recognised by police that therapy providers have a duty in law to assure 


themselves that any disclosure to the police complies with data protection legislation. 


3. Police must have in place all the safeguards relating to sensitive processing for law 


enforcement purposes, including an appropriate policy document. 


4. Informationcompliant with Section 44 GDPR must be provided to victims before 


processing data obtained from a therapy provider. 
Concluding remarks 


It is recognised that this is a complex area with a range of legislation impacting business 
processes designed to provide support to traumatised victims whilst allowing criminal 


investigations to continue. 


Data protection law provides gateways for the sharing of therapy data in cases where it 


is strictly necessary but, as discussed in this consultation response, this must not bea 
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routine operation and it should never be conducted without due consideration of the 


rights and freedoms of the victim. 


Whilst we have stated that consent should not be relied upon as the lawful basis for 
sharing sensitive personal information, the needs, concerns and preferences of the 
victim must be central to the consideration of the extent to which disclosing such 


informationcan be justified in the context of a particular investigation. 


Aboveall, there needs to be transparency, and victims need to understand, from the 


outset of any therapy, how their data will be processed and what their rights are. 


We believe there are opportunities to strengthen these points in the proposed revised 


guidance. 


The ICO plans to publish guidance on sharing data with law enforcement authorities 
before the end of 2020. 
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Responses to consultation questions 


Question 1 


Will the revised guidance and, in particular, the key message that therapy 
should not be delayed for any reason connected with a criminal investigation or 
prosecution, encourage victims to obtain the therapy they need in a timely 


fashion? 


This message is clear but, in order for this to be realistic, therapy providers need 
to ensure that their processing is fair, transparent, and that victims have trust 


that the data will be used appropriately with due regard for their privacy. 


Question 2 


Will the revised guidance assist in addressing the perception that therapy will 


damage the prosecution case? 


This does not relate to the application of data processing legislation. Therefore, 


we are not responding to this question. 


Question 3 


Will the revised guidance assist in raising awareness of how a traumatised victim 


may present? 


It may assist, but it does not fully cover the issue of the extent to which a 


traumatised victim will be in a position to provide fully informed, freely given 


consent at different stages following the incident, and the significant challenges 


this raises. 


Question 4 
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Will the revised guidance including the content of Annex A assist in raising 


awareness about different forms of trauma-based therapy? 


This does not relate to the application of data processing legislation. Therefore, 


we are not responding to this question. 


Question 5 


Is the revised guidance covering therapies that might cause difficulties at pages 


12 and 13 accurate, useful and comprehensive? 


This does not relate to the application of data processing legislation. Therefore, 


we are not responding to this question. 


Question 6 


Is the revised guidance for therapists at pages 5 and 6 covering discussions with 
a victim priorto the commencement of pre-trial therapy accurate, useful and 


comprehensive? 


It would be helpful for the guidance to remind therapists of their obligations 
under the GDPR to be transparent and ensure that they provide victims with 
information regarding the processing of their data. The specifics of these 
requirements are set out in Article 13 (in relation to data the victim will be 


providing themselves) and Article 14 (in relation to data provided by the police), 


and they include ensuring the victim is fully informed of their information rights, 


including their right to object to processing at any point. 


Question 7 
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Does the revised guidance including Annex B provide sufficient clarity to 
therapists around how to record a disclosure of criminality made by a victim 


during the course of therapy? 


The guidance would benefit from the inclusion of further information to assist 
therapy providers in understanding their obligations in relation to processing 
personal data relating to criminal offences, as discussed in the introductory 


sections of this consultation response. 


Question 8 


Does the revised guidance provide sufficient clarity to therapists around 


procedures to follow when called upon to assist with a police investigation? 


In relation to disclosure of therapy notes to a prosecutor, your guidance could be 
clearer in stating that the therapy provider should feel confident in challenging 
the prosecutor to be explicit regarding their lawful basis for requesting disclosure 
of the records and their demonstration of why this is strictly necessary, in order 
that the therapist is able to conduct they own assessment of substantial public 


interest. 


The request should be specific (e.g. spanning a specific time period and related 
to a particular issue) rather than general, and prosecutors must be able to 


demonstrate the relevance of their specific enquiries. 


Police should not simply be allowed to speculatively browse patient files in order 


to decide whether anything might be of interest. 


Decisions regarding sharing data should be justified and documented. 


The details of gateways available for sharing are discussed in the introductory 


sections of this consultation response. 


Question 9 
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Does the revised guidance provide sufficient clarity around the circumstances 
when an investigator might seek access to pre-trial therapy notes during the 
course of an investigation including the importance of avoiding speculative 


enquiries? 


In order to assist compliance with data protection legislation and reduce the 
likelihood of speculative enquiries it is recommended that the wording of the 
guidance at sections 5b-5e is reconsidered in light of the preceding discussion in 


this consultation response. 


Question 10 


Does the revised guidance provide sufficient clarity around the process that 
should be followed when an investigator seeks access to pre-trial therapy notes 


including obtaining the victim’s informed consent? 


Please see to our earlier discussion in relation to the challenges associated with 
relying on ‘informed consent’, particularly in relation to the extent to which this 


can be freely given and able to be withdrawn at any time. 


Again, we would recommend sections 5b-5e of the guidance be reconsidered in 


light of the preceding discussion in this consultation response. 


Question 11 


Does the revised guidance provide sufficient clarity around the circumstances 
when an investigator will be required to pass material contained within pre-trial 


therapy notes to a prosecutor? 


The guidance is helpful in that it discussed the disclosure test, and it is hoped 


that this process will be made easier if a more focused approach to obtaining 


material from therapy providers is taken in the first instance. 
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Question 12 


Does the revised guidance provide sufficient clarity around the circumstances 
when a prosecutor might be required to disclose material contained within pre- 
trial therapy notes to the defence and how, during that process, consideration is 


given to the consent of the victim? 


The discussion in this consultation response has outlined the difficulties 
associated with relying on consent in a criminal justice environment (as per 
Question 10). 


The guidance could either use an alternative term to indicate the agreement of a 
victim to comply with the process, or providea description of how this is 


different to the term ‘consent’ as it is applied in data protection legislation. 


It would be helpful to refer to the victim’s right to object to processing in this 


context. 


Question 13 


Do you have any other feedback you wish to share around how the revised 


guidance could be improved? 


In its current form, it does not address the concerns expressed by victims about 
their lack of confidence in how their privacy is respected during criminal 
investigations. The discussion in this consultation response should be used to 


improve the draft in this respect. 
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